Methods and apparatus for detecting malware samples with similar image sets
Active Publication Date: 2017-06-06
INVINCEA
View PDF5 Cites 31 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Benefits of technology
The patent describes a system that can extract image data from a binary file and adjust it to a specific size. It can also convert the image data to a grayscale format and calculate modified pixel values for each pixel. The system can compare these values with a set of reference vectors stored in a malware detection database to determine if the input file is associated with malicious software. The system provides a way to quickly and efficiently analyze binary files for potential threats.
Problems solved by technology
Small differences in code can, however, cause such a system to incorrectly determine that the application is not malware.
Additionally, it can be difficult to access all portions of the code in a computer application to determine whether the application may be malware.
Further, analyzing code alone may not allow a system to identify tactics malware writers use to reach users, and therefore may not allow administrators to draw inferences from the tactics of known malware samples to determine the likelihood that the computer application is also malware.
Further, merely analyzing the code may cause difficulties in visualizing the results of analyzing the computer application, such that a malware analyst can later use the results to perform other actions, such as determining where to focus future malware analysis.
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0014]In some embodiments, a malware detection server can obtain a set of image assets associated with a potential malware input sample. Such assets can include a desktop icon image, icons and / or images a potential user views while running the potential malware input sample, and / or other images from the potential malware input sample. The malware detection server can normalize the images (e.g., scale images to a predetermined size, scale images to a predetermined resolution, change color images into black-and-white images, etc.), and can generate image binary vectors based on the normalized images. The image binary vectors can be compared with vectors generated for known malware assets (e.g., based on determining the nearest neighbors of each image binary vector and determining distances between that image binary vector and vectors associated with the nearest neighbors). Based on the comparison, the malware detection server can determine a likelihood that the potential malware input...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
An apparatus can include a processor that can extract, from an input binary file, an image data structure, and can scale the image data structure to a predetermined size, and / or modify the image data structure to represent a grayscale image. The processor can calculate a modified pixel value for each pixel in the image data structure, and can define a binary vector based on the modified pixel value for each pixel in the image data structure. The processor can also identify a set of nearest neighbor binary vectors for the binary vector based on a comparison between the binary vector and a set of reference binary vectors stored in a malware detection database. The processor can then determine a malware status of the input binary file based on the set of nearest neighbor binary vectors satisfying a similarity criterion associated with a known malware image from a known malware file.
Description
CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application claims priority to and the benefit of U.S. Provisional Application Ser. No. 62 / 250,821, filed Nov. 4, 2015 and entitled “Methods and Apparatus for Detecting Malware Samples with Similar Image Sets.” The entire contents of the aforementioned application are herein expressly incorporated by reference.GOVERNMENT CONTRACT[0002]This invention was made with government support under Government Contract No. FA8750-10-C-0169, awarded by the Department of the Air Force. The government has certain rights in the invention.BACKGROUND[0003]Malware detection systems can be configured to detect the presence of malware on compute devices. Some known malware detection systems can use known assets of identified malware samples to determine whether a computer application was likely made by the same entity that created the malware samples, and therefore whether the computer application likely is malware itself. For example, some known malware...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More IPC IPC(8): G06F21/56
CPCG06F21/565
InventorLONG, ALEXANDER MASONSAXE, JOSHUA DANIEL
OwnerINVINCEA